name: CI

# Only pushes to this repository, no pull_request: the runner allows privileged
# containers, and a pull request from a fork could otherwise run its own
# workflow with root access on the runner machine.
on:
  push:
    branches: ["**"]

jobs:
  test-bookworm:
    # Same Python, Flask and argon2 versions as Raspberry Pi OS Bookworm.
    runs-on: ubuntu-latest
    container: debian:bookworm
    steps:
      - name: Install Debian packages
        run: |
          apt-get update
          DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
            ca-certificates git python3 python3-flask python3-argon2 python3-websocket python3-pytest shellcheck
      - name: Checkout
        # Plain git: JavaScript actions need Node, which debian:bookworm doesn't have.
        run: |
          git clone "${{ github.server_url }}/${{ github.repository }}.git" .
          git checkout "${{ github.sha }}"
      - name: Tests
        run: python3 -m pytest -p no:cacheprovider
      - name: Shellcheck
        run: shellcheck -S warning install.sh install-online.sh update.sh uninstall.sh tools/release-upload.sh image/build.sh image/stage-daynivo/prerun.sh image/stage-daynivo/00-daynivo/00-run.sh bin/daynivo-kiosk-x

  test-latest:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.13"
      - run: pip install -r requirements-dev.txt
      - run: python -m pytest